aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorAlexander Lobakin <alobakin@marvell.com>2020-07-23 01:10:35 +0300
committerDavid S. Miller <davem@davemloft.net>2020-07-22 18:19:03 -0700
commit9b6ee3cf95d322ab02e9927f5b08ebc870ca9f1f (patch)
tree08bd8489f541676ab787ef9249beb2a925da2e7e /drivers
parentqed: prevent possible double-frees of the chains (diff)
downloadlinux-dev-9b6ee3cf95d322ab02e9927f5b08ebc870ca9f1f.tar.xz
linux-dev-9b6ee3cf95d322ab02e9927f5b08ebc870ca9f1f.zip
qed: sanitize PBL chains allocation
PBL chain elements are actually DMA addresses stored in __le64, but currently their size is hardcoded to 8, and DMA addresses are assigned via cast to variable-sized dma_addr_t without any bitwise conversions. Change the type of pbl_virt array to match the actual one, add a new field to store the size of allocated DMA memory and sanitize elements assignment. Misc: give more logic names to the members of qed_chain::pbl_sp embedded struct. Signed-off-by: Alexander Lobakin <alobakin@marvell.com> Signed-off-by: Igor Russkikh <irusskikh@marvell.com> Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/ethernet/qlogic/qed/qed_chain.c21
-rw-r--r--drivers/net/ethernet/qlogic/qed/qed_sp_commands.c4
2 files changed, 12 insertions, 13 deletions
diff --git a/drivers/net/ethernet/qlogic/qed/qed_chain.c b/drivers/net/ethernet/qlogic/qed/qed_chain.c
index 917b783433f7..a9ff15b9d8c0 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_chain.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_chain.c
@@ -49,7 +49,7 @@ static void qed_chain_free_pbl(struct qed_dev *cdev, struct qed_chain *chain)
{
struct device *dev = &cdev->pdev->dev;
struct addr_tbl_entry *entry;
- u32 pbl_size, i;
+ u32 i;
if (!chain->pbl.pp_addr_tbl)
return;
@@ -63,11 +63,10 @@ static void qed_chain_free_pbl(struct qed_dev *cdev, struct qed_chain *chain)
entry->dma_map);
}
- pbl_size = chain->page_cnt * QED_CHAIN_PBL_ENTRY_SIZE;
-
if (!chain->b_external_pbl)
- dma_free_coherent(dev, pbl_size, chain->pbl_sp.p_virt_table,
- chain->pbl_sp.p_phys_table);
+ dma_free_coherent(dev, chain->pbl_sp.table_size,
+ chain->pbl_sp.table_virt,
+ chain->pbl_sp.table_phys);
vfree(chain->pbl.pp_addr_tbl);
chain->pbl.pp_addr_tbl = NULL;
@@ -190,7 +189,7 @@ static int qed_chain_alloc_pbl(struct qed_dev *cdev, struct qed_chain *chain,
struct device *dev = &cdev->pdev->dev;
struct addr_tbl_entry *addr_tbl;
dma_addr_t phys, pbl_phys;
- void *pbl_virt;
+ __le64 *pbl_virt;
u32 page_cnt, i;
size_t size;
void *virt;
@@ -214,7 +213,7 @@ static int qed_chain_alloc_pbl(struct qed_dev *cdev, struct qed_chain *chain,
chain->b_external_pbl = true;
} else {
- size = array_size(page_cnt, QED_CHAIN_PBL_ENTRY_SIZE);
+ size = array_size(page_cnt, sizeof(*pbl_virt));
if (unlikely(size == SIZE_MAX))
return -EOVERFLOW;
@@ -225,8 +224,9 @@ static int qed_chain_alloc_pbl(struct qed_dev *cdev, struct qed_chain *chain,
if (!pbl_virt)
return -ENOMEM;
- chain->pbl_sp.p_virt_table = pbl_virt;
- chain->pbl_sp.p_phys_table = pbl_phys;
+ chain->pbl_sp.table_virt = pbl_virt;
+ chain->pbl_sp.table_phys = pbl_phys;
+ chain->pbl_sp.table_size = size;
for (i = 0; i < page_cnt; i++) {
virt = dma_alloc_coherent(dev, QED_CHAIN_PAGE_SIZE, &phys,
@@ -240,8 +240,7 @@ static int qed_chain_alloc_pbl(struct qed_dev *cdev, struct qed_chain *chain,
}
/* Fill the PBL table with the physical address of the page */
- *(dma_addr_t *)pbl_virt = phys;
- pbl_virt += QED_CHAIN_PBL_ENTRY_SIZE;
+ pbl_virt[i] = cpu_to_le64(phys);
/* Keep the virtual address of the page */
addr_tbl[i].virt_addr = virt;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
index 8142f5669b26..aa71adcf31ee 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
@@ -366,11 +366,11 @@ int qed_sp_pf_start(struct qed_hwfn *p_hwfn,
/* Place EQ address in RAMROD */
DMA_REGPAIR_LE(p_ramrod->event_ring_pbl_addr,
- p_hwfn->p_eq->chain.pbl_sp.p_phys_table);
+ qed_chain_get_pbl_phys(&p_hwfn->p_eq->chain));
page_cnt = (u8)qed_chain_get_page_cnt(&p_hwfn->p_eq->chain);
p_ramrod->event_ring_num_pages = page_cnt;
DMA_REGPAIR_LE(p_ramrod->consolid_q_pbl_addr,
- p_hwfn->p_consq->chain.pbl_sp.p_phys_table);
+ qed_chain_get_pbl_phys(&p_hwfn->p_consq->chain));
qed_tunn_set_pf_start_params(p_hwfn, p_tunn, &p_ramrod->tunnel_config);